Security Weekly · 2026-11-07 – 2026-11-13

The Week in 60 Seconds

Observed sshole exploitation and rapid probing of exposed refrigeration systems put externally reachable services first: the evidence spans high-privilege SSH access, administrator-level refrigeration access, and attempted temperature manipulation. [1][2][3]

Code-execution exposure remains concentrated in software that evaluates attacker-influenced input or loads modified components, including the promzard npm package and a ComfyUI custom-node path. [4][5]

This week also combines security-release activity across Node.js and Microsoft products with browser privacy hardening, requiring teams to distinguish actionable product updates from broader platform-protection improvements. [6][7][8][9]

Security & Exploitation

Identity · Sans Isc Diary

What happened

The honeypots use Cowrie to collect SSH data and are seeing increased attempts to exploit the “sshole” vulnerability, identified as CVE-2026-123158. [1]

The source reports that longer passwords are highly unusual and are not used for the usual password brute-forcing it observes. [1]

AI & Agents · Arstechnica Security

What happened

Researchers report active exploitation of the critical *sshole vulnerability, which arises from interaction between OpenSSH and the musl library and can affect Linux systems meeting additional requirements. [2]

On affected systems, the vulnerability can provide unauthenticated access to high-privilege accounts within seconds. [2]

Why it matters

Greynoise said its Southeast Asian honeypots were attacked by a group it tracks as GT10, describing the activity as mature intrusions. [2]

Identity · Cyberscoop

What happened

VulnCheck disclosed 14 vulnerabilities in Copeland-manufactured Dixell refrigeration units; all affect the XWEB EVO supervision system. [3]

Lab testing with rebuilt vendor firmware indicated that each flaw could provide an attacker root or administrative access to the affected unit. [3]

Why it matters

In an XBOW honeypot experiment, internet-exposed servers mimicking affected vendors and models were probed within a day, including attempts to alter temperature settings. [3]

Vulnerability · Tenable Blog

What happened

U.S. agencies urged critical-infrastructure organizations to secure industrial refrigeration and cold-chain monitoring systems after reported attacks involving French blood banks and European supermarkets. [10]

The agencies said attackers are targeting refrigeration controllers through unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords, then using remote access to manipulate temperatures and spoil food, blood, or other products. [10]

Why it matters

The agencies said temperature changes could damage refrigerated products and trigger fire hazards, creating risks for healthcare, food and agriculture, chemicals, and transportation operations. [10]

The Dixell findings and agency warning both center on remotely reachable refrigeration controls where administrative access or controller compromise can enable temperature manipulation with operational consequences. [3][10]

Both reports address exposure of refrigeration-control systems to remote temperature changes; they do not establish a shared vendor, actor, or incident. [3][10]

AI & Agent Security

Identity · Certcc Vulnotes

What happened

ComfyUI-Easy-Use version 1.4.1 and earlier has a vulnerability in save_preview() that lets an unauthenticated attacker overwrite an installed custom node’s Python file. [5]

An attacker can upload a Python file to ComfyUI’s input directory and use save_preview() to replace a custom node’s __init__.py; ComfyUI imports and executes the modified node after restart. [5]

Why it matters

Successful exploitation allows arbitrary Python code and operating-system commands with the privileges of the ComfyUI process. [5]

Cloud & Platform

AI & Agents · Nodejs Node Releases

What happened

Node.js version 22.23.5 'Jod' is identified as an LTS security release. [7]

The release lists high-severity fixes for HTTP/2 stream and write handling, nested parser execution in TLS/HTTP, and TLS SNI or mTLS resumption behavior. [7]

Identity · Nodejs Node Releases

What happened

Node.js 26.13.1 “Lithium” (LTS) is identified as a security release. [6]

The release lists high-severity fixes for HTTP/2 stream and buffer handling, TLS parser execution, SNI and mTLS resumption behavior, and a remotely reachable TLS server crash. [6]

Supply Chain · Certcc Vulnotes

What happened

The npm library promzard, versions 4.0.0 and earlier, is vulnerable to remote code execution because context-object keys are interpolated as unsanitized JavaScript source and evaluated. [4]

promzard evaluates a generated function-expression source string with vm.runInThisContext(), allowing attacker-controlled syntax in a context key to execute during evaluation. [4]

Why it matters

An attacker who can influence ctx keys, including through a parsed configuration file, HTTP request, or environment variable, can break out of the function-parameter list and inject arbitrary JavaScript into the Node.js process. [4]

Research & Emerging Techniques

Research · Mozilla Security Advisories

What happened

Firefox’s latest fingerprinting protections reduce the browser and device details extractable by tracking scripts, making more Firefox users appear alike and strengthening privacy during browsing. [9]

Browser fingerprinting combines details such as available fonts, screen dimensions, and graphics hardware to identify users across websites without cookies. [9]

Why it matters

Firefox limits some screen-resolution information, coarsens reported processor counts, and improves consistency for image rendering, Web Audio, and mathematical operations on Android to reduce distinguishing details. [9]

Policy & Industry

AI & Agents · Cyberscoop

What happened

Microsoft’s November security update formally lists 1,094 CVEs, including 726 affecting Windows and 174 affecting Office; additional patches cover SQL Server, Exchange Server, SharePoint Server, Azure and other products. [8]

Only one flaw was under active attack when the update was released, and none were publicly known beforehand. [8]

Why it matters

CVE-2026-124194 was added to CISA’s Known Exploited Vulnerability list shortly after Microsoft released the advisory. [8]

Heimdall's Read

Honeypot observations and researcher reporting independently place sshole in an active exploitation context: attempted exploitation was observed in Cowrie data, while affected systems can expose high-privilege accounts without authentication. [1][2]

Both candidates concern sshole activity, with one reporting honeypot attempts and the other reporting active exploitation and its high-privilege access consequence. [1][2]

The two Node.js LTS releases show parallel security-maintenance work across supported release lines, with both addressing high-severity HTTP/2 and TLS-related issues. [7][6]

Both are Node.js LTS security releases that list high-severity fixes affecting HTTP/2 handling and TLS behavior. [7][6]